New that day
- highpatchedexploited GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-24).
- highpatchedexploited Sangoma FreePBX OS Command Injection Vulnerability Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-24).
- highpatchedexploited Sangoma FreePBX Improper Authentication Vulnerability Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-24).
- highpatchedexploited SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-06).